Invalid ViewState

July 16, 2005 @ 11:56 pm

I’ve been working with a customer who is working with my application as a typical end user would. This means, they often use the browser in ways the application isn’t meant to be used <g>. If you want to translate that: It means they use the BACK button a lot.

One of my application pages is fairly complex and it contains about 50 fields or so which are displayed with a tabbed display and used to display inventory data.

I’ve been getting a ton of Invalid Viewstate errors which looks like this in my error log:

/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Invalid_Viewstate

Client IP: 68.116.115.30

Port: 47723

User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.1 (KHTML, like Gecko) Safari/312

ViewState: dDwtMTc0Nzg0MDU5OztsPFd3d2ViY2hlY2tib3gxO3R4dG5vd2ViO1d3d2ViY2hlY2tib3gyOz4+wsDm0DO4DrTgsEuGylUVMawoGG0=

Http-Referer: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Path: /store/admin/EditInventoryItem.aspx.

on 7/17/2005 12:10:52 am

--- Stack Trace ---

at System.Web.UI.Page.LoadPageStateFromPersistenceMedium()

at System.Web.UI.Page.LoadPageViewState()

at System.Web.UI.Page.ProcessRequestMain()

--- Request Information ---

Full Url: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

IP: 68.116.115.30

Referer: http://www.kidswhorip.com/store/admin/EditInventoryItem.aspx?Sku=KWR_TSHIRT_BW_ORANGE

Browser: Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/312.1 (KHTML, like Gecko) Safari/312

Locale: en

--- Raw Post Buffer ---

__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=dDwtMTc0Nzg0MDU5OztsPFd3d2ViY2hlY2tib3gxO3R4dG5vd2ViO1d3d2ViY2hlY2tib3gyOz4%2BwsDm0DO4DrTgsEuGylUVMawoGG0%3D&txtsku=KWR_TSHIRT_BW_ORANGE&txt _EditTabs=Detail

... additional data removed for brevity

I’ve seen the errors happening on the user’s browser configuration but no matter how I try here I can’t duplicate a repeatable scenario.

What’s even worse is that this page has ViewState disabled – my app doesn’t need or use it, so the viewstate used is only in use for ASP.NET internally.

After some more searching I ran intot he following KB Article:

Intermittent Invalid Viewstate Error in ASP.NET Web pages

This article suggests that the error might occur because of Application Pool cycling. The solution to this problem is to set a flag in machine.config to prevent ASP.NET to generate a new key everytime an Application starts.

I tried to get this to fail, simply by restarting IIS, but that didn’t do it for me – I got no failure, so I’m still not quite sure what is causing the Invalid ViewState scenario to occur.

The first thing I’m trying right now is to set EnableViewStateMac=”false” in the page and see if that helps. I suspect this will fix the problem, but I’d still like to know why the validation is failing on the host server.

Feedback for this Weblog Entry

re: Invalid ViewState
by TP July 17, 2005 @ 8:07 am

I have also seen the invalid view state error when loading user controls dynamically. We never really solved this problem because it occurred so seldom. We had followed all of the recommendations from MSDN but it never truly solved the problem.

When the error occurred it always happened on the same page and the same asp.net event.

The patch that was offered to help track down the problem caused more problems because it broke other asp.net applications, not sure why.

re: Invalid ViewState
by Fabio Vazquez July 19, 2005 @ 4:32 pm

Hi Rick,

I had a similar problem in an environment using clustered machines. It seemed that the user was getting responses from different machines of the cluster, so the ASP.NET was thinking that the viewstate data was corrupted. Setting EnableViewStateMac=”false” solved the problem, but the real solution was actually change the <MachineKey> element to use the same hash generation key on both machines of the cluster.

I don't know if this scenario applies to your case, but it was really the problem that bothered me for some days.

re: Invalid ViewState
by Dave A July 20, 2005 @ 4:05 am

Rick,

I get this all of the time when someone is visiting one of my large webapplication sites using Pocket IE. This is not uncommon since the web site integrates with the PPC using SOAP and so a user will often log on to see the data that they have collected.

It has not yet become important enough to warrent further investigation - I have just been putting it down to PIE being buggy.

re: Invalid ViewState
by Rick Strahl July 20, 2005 @ 11:04 am

Just an update - turning EnableViewStateMac off on the page fixed the problem as far as I can see. I'm not to worried about Viewstate hacking, so I'm going to try and turn this off at least on all of the admin backend pages. It still sucks that this is happening

Another way to fix the pooling/cycling problem
by Tim Farley July 22, 2005 @ 5:29 am

Instead of stting EnableViewStateMac=false, I think you can solve this a different way: generate a specific crypto key for your application to use and put it in the <machineKey> section of your web.config. That way, even if the application cycles, it will come back using the same crypto key.

re: Invalid ViewState
by Rick Strahl July 22, 2005 @ 10:09 am

Right, I mentioned that, but because this app is running at an ISP I don't have control over the machinekey.

re: Invalid ViewState
by Morgan Belford July 29, 2005 @ 2:12 pm

Safari, through version 2.0, has a problem with ViewState. In our experience, when you open a window using javascript (e.g., window.open), the page you open to, or sometime the next page, can have the following problem: when you submit a postback from that page, the browser sends the viewstate (__VIEWSTATE) from a previous form (on a previous page).

Specifically, in Safari only:
1. window.open("page1.aspx")
2. page1.aspx has form with __VIEWSTATE
3. Do normal hyperlink from page1.aspx to page2.aspx (i.e, don't do a postback)
4. On page2.aspx, perform an operation that does a postback
5. See viewstate error -- we note that the viewstate sent to the server was from the form in page1.aspx, not page2.aspx.
6. If you put an alert at the bottom of page2.aspx, to display __VIEWSTATE from forms[0], you will see the viewstate of the previous page's form, but if you do a view source of page2.aspx, you will see the correct view state.

We are doing no server transfers or anything like that.

In Safari 1.0, but no longer, we saw the same problem, in the case where step 3 was replaced by page1.aspx emitting javascript that caused an immediate page reload to page2.aspx(e.g., "window.location = 'page2.aspx'")

Note that the <form> tags in each of these pages have unique names and ids, and that the size of viewstate is 2-4K.

re: Invalid ViewState
by Jon Stalnaker August 10, 2005 @ 5:19 am

I'm glad this topic is beginning to be covered more often. In my scenario, we have a clustered server and changed the machinekey to identical values so that was covered, but we do recycle the application pool every 12 hrs, so I will take a look at changing that to non-peak hours.

It's been my experience that 99% of the users who receive this error are using the Mac PowerPC or mobile browsers. Rarely does a user who is running IE 6.0 encounter the error.

re: Invalid ViewState
by Ian August 11, 2005 @ 11:58 am

I too am having this problem ONLY with the Mac users. I've read that some proxies limit the size of hidden fields and I put in a fix I found at this link but it just changed the error so I pulled it out.

http://weblogs.asp.net/pwilson/archive/2003/08/21/24867.aspx

I've also noticed that it only appears to happen when doing a redirect (not a transfer).

re: Invalid ViewState
by Dave September 08, 2005 @ 4:01 pm

We are getting bursts of about 12 post attempts 2 seconds apart which look as if they are malicious posts, triggering the view state error. In all cases no browser information is sent with the request. I have noticed this over about the last 2 months, and it is getting more frequent. It looks like the hacker is trawling all the links from our home page and trying to post to these pages - some of which should never be posted to. Anyone else seen this?

re: Invalid ViewState
by Jack April 03, 2006 @ 3:16 am

Hi we are seeing the same problem as Morgan Belford. As far as I can work out our scenario is as follows:

A user logins into the site they browse around. They leave the session idle and then return. Their session/authentication has expired so they are redirected to our login page to re-authenticate. The previous pages viewstate is also passed to the login page causeing it to fall on its face.

We see this with Safari/417.8 - Safari/417.92 and WebTV/2.5.9

I have yet to find a solution... :(

re: Invalid ViewState
by Bruce Hemmerich May 26, 2006 @ 9:40 pm

Doesn't turning EnableViewStateMac off cause any security concerns? Aren't we talking about message authentication code?

I agree with Tim Farely's solution above.

I highly recommend everyone read (http://www.aspnetresources.com/articles/ViewState.aspx#) this excellent article about this exact problem.

Good luck.

re: Invalid ViewState
by Rick Strahl May 26, 2006 @ 11:14 pm

Bruce, it depends of what you put into ViewState. Don't use ViewState you don't need to protect it <g>.

ViewState security makes sense in certain scenarios but in most I don't see what the fuss is about. Heck most of our apps POST data to the server that's not encrypted and you can do a lot more damage with that than with ViewState (again unless you put sensitive data into ViewState).

re: Invalid ViewState
by Ben Strackany August 23, 2006 @ 9:00 am

Apparently viewstate errors can also occur if you're using Server.Transfer, per

http://aspalliance.com/909.

Also, if your server is at an ISP, you can put a machineKey into the web.config instead. I have a machingeKey generator at

http://www.developmentnow.com/articles/machinekey_generator.aspx

if anyone needs one.

DotNetSlackers: Invalid ViewState
by DotNetSlackers Latest ASP.NET News October 11, 2006 @ 4:55 am

ASP.NET Forums - ViewStateException Invalid ViewState
by State Management January 01, 2007 @ 8:42 am

ViewStateException Invalid ViewState - ASP.NET Forums
by ASP.NET Forums June 01, 2007 @ 5:29 am

re: Invalid ViewState
by parwej November 06, 2007 @ 12:54 am

I am facing same problem. Safari users on Mac are getting Viewstate error.
I have used two methods to open a new window in which application runs.

Below is the C# code used my me.

Method 1:

Page.RegisterStartupScript("AppicationInNewWindow","<script language=javascript>OpenApp(url)</script>");

The OpenApp() is a javascript function which opens the Appication into new window using window.open.

Method 2:

Page.RegisterStartupScript("ChangeURL","<script language=javascript>window.location.href=url</script>");

In this method application is already opened in new window, so i have used window.location.href to change the url.

Both these methods are working fine for IE and Mozilla browsers. But Safari users get Invalid viewState error in Method 2. I have tried making EnableViewStateMac off for this particular page. But then page does not get postback event for first time. Please suggest any way to get rid of this error. Ur help would be greatly appreciated.

re: Invalid ViewState
by Stephanie November 21, 2007 @ 10:45 am

I too am getting the famous Invalid Viewstate error on my websites registration page. It only happens occassionally and I can not for the life of me reproduce it. I don't know if it is a browser issue or something else. The form is not that big and it is posted back to itself not another form. I do not have a server farm and have generated a key and put it in my machine.config, but I still get the error randomly. Any ideas would be greatly appreciated.

re: Invalid ViewState
by Grant January 10, 2008 @ 3:27 pm

I have the same problem, but have found a simple fix. I also have been playing around with machine keys and so forth, to no avail. I didn't notice that the Message of the exception said "The client disconnected" until earlier today. What's happening is the the user is interrupting the postback (by hitting BACK, closing the browser, or whatever) so not all the data is getting sent back to the server. Thus ASP.NET is (rightly) throwing an exception.

I have an HTTP module that handles all unhandled exceptions, so putting something like this in the ErrorHandler should do the trick :

public void HandleError (object sender, EventArgs e) {
HttpContext context = HttpContext.Current;
if (theError.Message.IndexOf("The client disconnected") == -1)
//handle the error
else
\\ignore it
}

Hope that helps!

re: Invalid ViewState
by Jol Blazey February 21, 2008 @ 5:03 pm

This link might be relevant.
http://connect.microsoft.com/VisualStudio/feedback/ViewFeedback.aspx?FeedbackID=101988

Back button:
Being a Java Spring developer also, this is the spring solution - pretty sure same rules apply: Back button problem is not a problem if the posted page does an http redirect to the success page. Then pressing back does not re-post, it really goes back. success page does an http GET ?id=savedid to show the results of the post for example.

Jol.